{"id":"CVE-2026-22110","title":"Missing authentication check on POST/PUT requests","summary":"The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-306"],"vendor":"Delta Electronics","product":"msi-image","affected":["msi-image < 2.4.18","ECP < 4.4.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T16:35:22.976391Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:35:40.502Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22110","references":[{"url":"https://csirt.divd.nl/DIVD-2026-00012"},{"url":"https://csirt.divd.nl/CVE-2026-22110"}],"tags":["cve.org"],"epss":0.0024,"epssPercentile":0.15212,"ingestedAt":"2026-11-05T16:24:31.091Z","slug":"CVE-2026-22110","body":"## Overview\n\nThe web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.\n\n## Affected\n\n- `msi-image < 2.4.18`\n- `ECP < 4.4.1`\n\n## Remediation\n\nUpdate to the latest version.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}